IDE:TYPO3

composer create-project "typo3/cms-base-distribution:^13.4" /var/www/typo3

# TYPO3 13 LTS – NGINX vhost
# Datei: /etc/nginx/sites-available/typo3.conf (Symlink nach sites-enabled)

server {
    listen 80;
    server_name example.com www.example.com;

    # Composer-Setup: DocumentRoot zeigt auf das "public" Verzeichnis
    root /var/www/typo3/public;
    index index.php index.html;
    charset utf-8;

    client_max_body_size 32m;

    # Basis-Security-Header
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options SAMEORIGIN;
    add_header Referrer-Policy no-referrer-when-downgrade;
    add_header X-XSS-Protection "1; mode=block";

    # Front-Controller
    location / {
        try_files $uri $uri/ /index.php$is_args$args;
    }

    # TYPO3 Backend: leitet über Front-Controller
    location ^~ /typo3/ {
        try_files $uri /index.php$is_args$args;
    }

    # Statische Assets
    location ~* \.(?:css|js|gif|ico|jpg|jpeg|png|svg|webp|avif|woff|woff2|ttf|eot)$ {
        try_files $uri =404;
        access_log off;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }

    # Favicons / Robots
    location = /favicon.ico { log_not_found off; access_log off; }
    location = /robots.txt  { log_not_found off; access_log off; }

    # Versteckte/empfindliche Dateien sperren
    location ~ /\.(?!well-known) { deny all; }
    location ~* /(composer\.(json|lock)|package\.json|yarn\.lock|webpack\..*|tsconfig\.json)$ { deny all; }
    location ~* (?:^|/)(?:LocalConfiguration|AdditionalConfiguration)\.php$ { deny all; }
    location ~* ^/(?:typo3conf|var|vendor|Build|Tests)(?:/|$) { deny all; }

    # Keine PHP-Ausführung in Upload-/Asset-Ordnern
    location ~* ^/(?:fileadmin|uploads|typo3temp|typo3conf|storage)/.*\.php$ {
        deny all;
    }

    # PHP-FPM
    location ~ \.php$ {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_param DOCUMENT_ROOT $realpath_root;
        fastcgi_param TYPO3_CONTEXT Production;
        fastcgi_param HTTPS $https if_not_empty;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
        fastcgi_read_timeout 120s;
        # Pfad ggf. auf die installierte PHP-Version anpassen (8.2/8.3)
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_index index.php;
    }
}